OSCP Password Attacks 2 — Questions and Answers
Question 1: What is password spraying and why is it preferred over traditional brute force in Active Directory environments?
- Using one common password against many accounts to stay below lockout thresholds (Correct answer)
- Using many passwords against a single account to maximize coverage
- Encoding passwords across multiple network segments simultaneously
- Applying rainbow tables against many hash types at once
Correct answer: Using one common password against many accounts to stay below lockout thresholds
Password spraying tests a single common password (e.g., 'Password123!') across many accounts, avoiding per-account lockout thresholds.
Question 2: Which Hashcat flag is used to specify a rules file that applies transformations to wordlist entries?
- -w
- -r (Correct answer)
- -m
- -a
Correct answer: -r
Hashcat's -r flag specifies a rules file containing transformation instructions such as capitalization, substitutions, and appending digits.
Question 3: What is the correct John the Ripper syntax to crack a hash file using a wordlist?
- john --crack hashfile.txt wordlist.txt
- john --wordlist=wordlist.txt hashfile.txt (Correct answer)
- john -w wordlist.txt -f hashfile.txt
- john hashfile.txt --dict=wordlist.txt
Correct answer: john --wordlist=wordlist.txt hashfile.txt
John the Ripper uses --wordlist= to specify the dictionary file, followed by the target hash file as a positional argument.
Question 4: Which authentication protocol is particularly vulnerable to pass-the-hash attacks?
- SSH
- FTP
- NTLM (Correct answer)
- Kerberos
Correct answer: NTLM
NTLM authentication can be bypassed by presenting a captured password hash directly, without ever cracking it to obtain the plaintext.
Question 5: What is the purpose of the rockyou.txt wordlist in password attacks?
- It contains known exploits for common web applications
- It is a large compilation of real-world leaked passwords from a data breach (Correct answer)
- It contains default credentials for common network devices
- It is a curated list of commonly used administrative usernames
Correct answer: It is a large compilation of real-world leaked passwords from a data breach
rockyou.txt was compiled from the 2009 RockYou data breach and contains over 14 million real passwords used by actual users.
Question 6: Which tool supports HTTP POST form brute force attacks for testing web application login pages?
- Hashcat
- John the Ripper
- Hydra (Correct answer)
- Mimikatz
Correct answer: Hydra
Hydra supports HTTP POST form attacks via its http-post-form module, allowing customizable credential testing against web login pages.
Question 7: What is credential stuffing?
- Inserting extra characters into passwords to increase complexity
- Using breached username and password pairs to attempt logins on other services (Correct answer)
- Padding credential fields with SQL injection strings to bypass validation
- Encrypting stolen credentials before exfiltration to avoid detection
Correct answer: Using breached username and password pairs to attempt logins on other services
Credential stuffing exploits password reuse by replaying leaked username/password pairs from one breach against other web services.
OSCP Password Attacks 2
What is password spraying and why is it preferred over traditional brute force in Active Directory environments?